Microsoft AzureOverview
Ensure that all Keys in Azure Key Vaults have an expiration date set.
Rationale
Azure Key Vault enables users to store and use cryptographic keys within the Microsoft Azure environment. The exp (expiration date) attribute identifies the expiration date on or after which the key MUST NOT be used to encrypt new data, wrap new keys, and sign. By default, keys never expire. Thus, keys should be rotated in the key vault, and an explicit expiration date should be set for all keys to help enforce the key rotation. This ensures that the keys cannot be used beyond their assigned lifetimes.
Impact
Keys cannot be used beyond their assigned expiration dates. They need to be rotated periodically wherever they are used.
Remediation guidance
Remediate from Azure Portal
- Open the key using the
Open in Azurebutton. - Set an appropriate
Expiration date.
Remediate from Azure CLI
Update the Expiration date for the key using the below command:
az keyvault key set-attributes --name <keyName> --vault-name <vaultName> --expires
Remediate from PowerShell
Set-AzKeyVaultKeyAttribute -VaultName -Name -Expires
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure Key Vault Keys without expiration date
Connectors
Covered asset types
Expected check: eq []
{
kmsKeys(where: { expiration: "0000-01-01T00:00:00.000Z" }) {
...AssetFragment
}
}
